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Abstract 

In this paper we compute the Fourier spectra of some recently dis- 
covered binomial APN functions. One consequence of this is the de- 
termination of the nonlinearity of the functions, which measures their 
resistance to linear cryptanalysis. Another consequence is that certain 
error-correcting codes related to these functions have the same weight 
distribution as the 2-error-correcting BCH code. Furthermore, for 
field extensions of F2 of odd degree, our results provide an alternative 
proof of the APN property of the functions. 
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1 Introduction 

Highly nonlinear functions on finite fields are interesting from the point of 
view of cryptography as they provide optimum resistance to linear and differ- 
ential attacks. A function that has the APN (resp. AB) property, as defined 
below, has optimal resistance to a differential (resp. linear) attack. For more 
on relations between linear and differential crypt analysis, see [TT] . 

Highly nonlinear functions are also of interest from the point of view of 
coding theory. The weight distribution of a certain error- correcting code is 
equivalent to the Fourier spectrum (including multiplicities) of /. The code 
having three particular weights is equivalent to the AB property, when n is 
odd. The minimum distance of the dual code being 5 is equivalent to the 
APN property holding for /. We give more details on the connections to 
coding theory in Section 2. 

For the rest of the paper, let L = GF(2 n ) and let L* denote the set of 
non-zero elements of L. Let Tr : L — > GF(2) denote the trace map from L 
to GF{2). 

Definition 1 A function f : L — > L is said to be almost perfect nonlin- 
ear (APN) if for any a G L,b G L* , we have 



Definition 2 Given a function f : L — > L, the Fourier transform of f is 

the function f : L x L* — > Z given by 



\{xeL: f(x + a)-f(x) = b}\<2. 




The Fourier spectrum of / is the set of integers 

A f = {f(a,b) : a,b G L,b ^ 0}. 
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The nonlinearity of a function / on a field L = GF(2 n ) is defined as 

NL(f) := 2 n - 1 - - max Id. 

The nonlinearity of a function measures its distance to the set of all affine 
maps on L. We thus call a function maximally nonlinear if its nonlinearity 
is as large as possible. If n is odd, its nonlinearity is upper-bounded by 
2'«-i _ while for n even an upper bound is 2 n_1 — 2? -1 . For odd n, 

we say that a function / : L — > L is almost bent (AB) when its Fourier 
spectrum is {0, ±2 _ 2 _ | ; in which case it is clear from the upper bound that 
/ is maximally nonlinear. We have the following connection (for odd n) 
between the AB and APN property: every AB function on L is also APN 
[11] . and, conversely, if / is quadratic and APN, then / is AB pi)]. In 
particular, quadratic APN functions have optimal resistance to both linear 
and differential attacks. On the other hand, there appears to be no relation 
between the nonlinearity and the APN property of a function when n is 
even. The reader is referred to [8] for a comprehensive survey on APN and 
AB functions. 

Recently, the first non-monomial families of APN functions have been 
discovered. Below we list the families of quadratic functions known at the 
time of writing. We remark that, in a sense to be qualified in the next section, 
these families are all pairwise inequivalent. 



ft \ 2 S +1 , 2 ik +2 mk+s 

j (x) = x ^ + ax ^ , 

where n = 3k, (k,3) = (s,3k) = 1, k > 3, i = sk mod 3, m = — i 
mod 3, a = t 2k ^ 1 and t is primitive (see Budaghyan, Carlet, Felke, 
Leander [6]). 



2. 



r/ \ 2 S +1 i 2 ifc +2' 

j{x) = x + ax 
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where n = 4k, (k, 2) = (s, 2k) — 1, k > 3, i = sk mod 4, m = 4 — z, 
a = t 2 * -1 and t is primitive (see Budaghyan, Carlet, Leander [3]). This 
family generalizes an example found for n = 12 by Edel, Kyureghyan, 
Pott pj. 

3. 

f{x) = ax 2S+1 + a 2 \ 2k+s+2k + Px 2k+1 + ]T lt x 2k+ ' +2 \ 

i=\ 

where n = 2k, a and f3 are primitive elements of GF(2 n ), and 7« e 
GF{2 k ) for each z, and (fc, s) = 1, fc is odd, s is odd (see Bracken, 
Byrne, Markin, McGuire pQ). 

4. 

/(x) =x 3 + Tr(x 9 ), 
over GF(2 n ), any n (see Budaghyan, Carlet, Leander [7j). 

5. 

. . 2~ k +2 k+s i 2 fc 2 S +1 , 2 k+a +2 8 

j{x)=ux ^ -\- U X + vx ^ , 

where n = 3k, u is primitive, v G GF{2 k ), (s, 3fc) = 1, (3, fc) = 1 and 3 
divides k + s (see Bracken, Byrne, Markin, McGuire PQ). 

In this paper we calculate the Fourier spectra of families (1) and (2). The 
determination of the Fourier spectra of families (3) and (4) has been given 
in [2] and [3], respectively, using other methods. The Fourier spectrum for 
family (5) has not yet been found, and is an open problem. We will show here 
that the Fourier spectra of the functions (1) and (2) are 5-valued for fields of 
even degree and 3-valued for fields of odd degree. In this sense they resemble 
the Gold functions x 2d+1 , (d,n) = 1. For fields of odd degree, our result 
provides another proof of the APN property. This does not hold for fields 
of even degree; as we stated earlier, there appears to be no relation between 
the Fourier spectrum and the APN property for fields of even degree. Thus, 
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the fact that / has a 5- valued Fourier spectrum for fields of even degree does 
not follow from the fact that / is a quadratic APN function. Indeed, there 
is one example known (due to Dillon [12]) of a quadratic APN function on 
a field of even degree whose Fourier spectrum is more than 5-valued; if u is 
primitive in GF(2 6 ) then 

g(x) = X 3 + U U X 5 + U 13 X 9 + X 17 + U U X 33 + X 4S 

is a quadratic APN function on GF(2 6 ) whose Fourier transform takes seven 
distinct values. 

The layout of this paper is as follows. In Section 2 we review the con- 
nections between APN functions, nonlinearity, and coding theory. Section 3 
gives the proof of the Fourier spectrum for family (1), and Section 4 gives 
the proof for family (2). In Section 5 we simply state for completeness the 
results from other papers on families (3) and (4), and Section 6 has some 
open problems for further work. 



2 Preliminaries on Coding Theory 

Fix a basis of L over F 2 . For each element x G L we write x = (cc 1( x n ) 
to denote the vector of coefficients of x with respect to this basis. Given a 
map / : L — ► L, we write /(x) to denote the representation of f(x) G L as 
a vector in Fg, and we consider the 2n x (2 n — 1) binary matrix 



where the columns are ordered with respect to some ordering of the nonzero 
elements of L 

The function / is APN if and only if the binary error-correcting code of 
length 2™ — 1 with Aj as parity check matrix has minimum distance 5. This 
is because codewords of weight 4 correspond to solutions of 

a+b+c+d = 
/(a) + /(&) + f(c) + f(d) = 
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and this system has no nontrivial solutions if and only if / is APN. We refer 
the reader to [§] for more on the connection between coding theory and APN 
functions. The dual code has Af as a generator matrix. The weights w in this 
code correspond to values V in the Fourier spectrum of / via V = n — 2w. 
Thus, when we compute the Fourier spectrum of an APN function, as we do 
in this paper, we are computing the weights occurring in the code. 

Suppose / is APN. Let Cj denote the code with generator matrix Af. 
Let a w denote the number of times the weight w occurs in C/. Let bj denote 
the number of codewords of weight j in Cj-. If there are five or fewer weights 
in Cf, the MacWilliams (or Pless) identities yield five independent equations 
6q = 1, bi = 62 = &3 = &4 = 0, for the unknowns ay, which can be solved 
uniquely. Thus the distribution of values is determined for an APN function 
whenever there are five or fewer values in its Fourier spectrum. In particular, 
if Af C {0,±2t,±2 I1 2^} for even n, or Af C {0,±2 !1 £ i } for odd n, then 
the distribution is completely determined. This is indeed the case for the 
functions studied in this paper. Solving for the distribution in this case 
must yield the same values and distribution as the double-error-correcting 
BCH code, which corresponds to the APN function x 3 . This function has 
Af = {0, ±2?, ±2^} for even n, and Af = {0, ±2^} for odd n, 

Consider the extended code of Cf, which has parity check matrix 



Pf 



1--- 1 1 1 
x ■■■ 

••• m ■■■ 

Two functions / and g are said to be CCZ equivalent if and only if the 
codes with parity check matrices Pf and P g are equivalent (as binary codes). 
This is not the original definition of CCZ equivalence, but it is an equivalent 
definition, as was shown in [TJ. 

The new APN functions presented in the introduction are known to be 
pairwise CCZ-inequivalent. One consequence of the results in this paper is 
that further invariants (beyond the code weight distribution) are needed to 
show that families (l)-(4) are inequivalent. 
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3 Family (1), Binomials over GF(2 3k ) 

We will make good use of the following standard result from Galois theory, 
which allows us to bound the number of solutions of a linearized polynomial. 
We include a proof for the convenience of the reader. 

Lemma 1 Let F be a field and let K, H be finite Galois extensions of F of 
degrees n and s respectively, whose intersection is F . Let M = KH be the 
compositum of K and H . Let k±, . . . , k t be F -linearly independent elements 
of K . Then fc l5 . . . , k t are H-linearly independent when regarded as elements 
ofM. 

Proof: 

Since K and H are Galois extensions of F and K f] H = F, we have [M : 
H\ — [K : F\ — n. Let {ki, . . . , k n } be an F-basis of if as a vector space 
over F, {hi,...,h s } an F-basis of if as a vector space over F. Then the set 
{ki ■ hj | 1 < i < n, 1 < j < s} generates M as a vector space over F. It 
is clear that the set {k\ ■ hi, . . . , k n ■ hi} generates M as a vector space over 
the field H. Without loss of generality we can assume that hi — 1. Since 
[M : H] = n, we conclude that {k i: . . . , k n } is indeed a basis of M over H. 

Let {ki, . . . , k t } be a set of F-linearly independent elements of K. We 
can extend this set to a basis {ki, . . . , k t , . . . , k n }. Since this set forms an 
iFbasis of M, its subset {ki, . . . ,k t } is a fortiori linearly independent over 
H. □ 

Note that for Galois extensions K, H in the lemma above, (s, n) — 1 
implies that K f] H — F and in the case when the fields K, H, F are finite, 
we have (s, n) — 1 if and only if K f] H — F. 

d 

Corollary 2 Let s be an integer satisfying (s, n) = 1 and let f(x) = nx 2 

i=0 

be a polynomial in L[x]. Then f(x) has at most 2 d zeroes in L. 
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Let V denote the set of zeroes of f(x) in L. We may assume that V 7^ {0}. 
Since f(x) is a linearized polynomial, V is a vector space over GF(2) of finite 
dimension v for some positive integer v. Let V C GF(2 sn ) denote the vector 
space generated by the elements of V over the field GF(2 S ). Since (s, n) = 1, 
we have L Q GF(2 S ) = GF(2) and by Lemma [TJ V' is a ^-dimensional vector 
space over GF(2 S ). Furthermore, for all c £ GF{2 S ) and £ GF(2 sn ) we 
have f(cw) = cf(w). Therefore all the elements of V are also zeroes of /(#). 
Since the dimension of V over GF(2) is t> , the size of V is 2 SW and it follows 
that there are at least 2 SV zeroes ot f(x) in GF(2 sn ). On the other hand, 
polynomial of degree 2 can have at most 2 ds solutions. We conclude that 

v < d. n 



Theorem 3 Let 

t( \ 2 S + 1 1 2 ik +2 mk + s 

j[x) = x + ax , 

where n = 3k, (fc, 3) = (s,3fc) = 1, A; > 3 ; i = sk mod 3, m = —i 
mod 3, a = t^ -1 and t is primitive in L. 

The Fourier spectrum off(x) is {0, ±2 _ 5 - } whenn is odd and{0, ±2^, ±2 
w/ien n is even. 

Proof: 

By the restrictions on i, s, k, there are two possibilities for our function f(x): 
fi(x) = x 2S+l + ax 2 k+2h+s s/c = — 1 mod 3 

and 

/ 2 (^) = x 2S+1 + «x 2t+2 k+s sk = 1 mod 3. 

Let us consider the first case, when f = fi- By definition, the Fourier 
spectrum of / is 

f w {a,b) = ^(-if(-WW). 
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Squaring gives 

f W (a b) 2 = ^ y^^_^Tr(ax+bf(x)+a(x+u)+bf(x+u)) 



x€L uGL 

This becomes 



u x 

where L b (u) := bu 2 ' + (bu) 2 s + (ba) 2k u 2 k+s + (6a) 2 * s u 2k ~ s . 

Using the fact that J2 X (— l) Tr ( ca; ) is when c ^ and 2 n otherwise, we 
obtain 



(au+bu 2S + 1 +bau 2 ~ k + 2k+S ) 



f w (a,b) 2 = 2 n J2(-i) Tr( ° 

uGK 

where K denotes the kernel of L b (u). If the size of the kernel is at most 
4, then clearly 

k _i_ofc + s . 



Since f w (a, b) is an integer, this sum can only be 0, 2, or 4 if n is even, and 
1 or 3 if n is odd. The set of permissible values of f w (a, b) is then 



f w (a,b)e 



{0,±2^} 2\n 
{0,±2f,±2^} 2\n. 



We must now demonstrate that \K\ < 4, which is sufficient to complete 
the proof. 

Note that since a is a (2 k — l)-th power, we have a 2 ' 2k+2k+1 = 1. Now 
suppose that L b {u) = 0. Then we have the following equations: 

(ba)- 2k L b (u) + b^-^aUiuf + b^ L b (uf k = 0, 



b- 2 ~ s L b {u) + b 2 - k - 3 - 2k - 3 - 2 - s a 2 - k - s L b (uf + b- 2k - s a' 2k - s L b {u) 2 - k = 0. 
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Substituting the definition of Lj,(u) into equations above and gathering the 
terms gives 

c x u A + c 2 u A + c 3 u z = 0, (1) 
dm 2 ' + d 2 u 2k+s + d 3 u 2 ~ k+s = 0, (2) 

where 

Ci = (tr 2 a z + tr 1 or ), 
c 2 = ((ba) 2 '"- s - 2k + 6 2k -+ 1 - 2 - k - 2k a) J 
c 3 = (62-+i-2 fc -2- fc Q! 2— +i + 6 2-*--2"*) j 

7 / T o — fc — siofc o — s nk — s n — k — s 7 i ofc — s o-fe-s i n — 5 i i \ 

rf 2 = (tr + a + o a +z 

d 3 = (b 2k - 2 ~ s a 2k + ^-z*— a 2-*— +2— ) < 

First we demonstrate that the coefficients Cj,dj in Equations (JTJ) and (j2J) 
do not vanish. Suppose that c x = 0. We then have 

^2 k ~ s +2 k _ ^-2 fe ~ s +2~ fe +2~ s -2 fe 

and taking 2 _fc -th power of both sides yields 

a 2" s +l _ j ) (2 fc+3 -l)(2- s -2- fe - s ) 

Let a = t 2 -1 , where t is primitive in GF(2 3k ). Substituting £ into the 
previous equation and some rearrangement gives 

^2 k ~ s -l _ ^2- s (l-2 fc + s )^(2 fc + s -l)(2- s -2- fc - s ) 

The multiplicative order of 2 modulo 7 is equal to 3, therefore for any r 
we have 7 divides 2 r — 1 if and only if r is divisible by 3. Since 3 \ k — s, 
we conclude that 7 f 2 fc ~ s — 1, therefore the left hand side is not a seventh 
power, while the right hand side is. We conclude that the coefficient of u 2 
in Equation (CQ) is not and use the same type of argument to conclude that 
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all the coefficients in Equation ([T]) are non-zero. A similar argument holds 
for Equation l^j. 

We will next combine Equation (CE]) and Equation (j2J) to obtain an equa- 
tion of the form 

Au + Bu 2k = 0. 

Raise Equation (CD) to the power of 2 s , Equation ([2]) to the power of 2~ s and 

q — k 

combine the two expressions, cancelling the terms in u to obtain 

Au + Bu 2 " = 0, (3) 

where A = (|) 2S + (f ) 2 " 3 and B = (f ) 2 * + (|) 2 ~ s . 

For now assume that both A, B are non-zero. We obtain the following 
equalities by applying the appropriate powers of the Frobenius automorphism 
to Equation (j3J): 

u2k -s =B -2-° A 2-* u 2-° 

Substituting the two identities above to our expression for L&(u) = gives 

(6+ (ba) 2k A- 2 ~"- a B 2 ~ k ~ B )u 2B + [b 2 ' 8 + (ba) 2 ' k ' s B~ 2 ~ s A 2 ' s )u 2 ' 3 = 0. (4) 

Raising this equation to the power of 2 s gives a polynomial of degree 2 2s 
which is GF(2 s )-linear. By Corollary [2j the dimension of the kernel of this 
polynomial over GF(2) is at most 2, unless the lefthand side of Equation (jlj) 
is identically 0. It therefore remains to show that the polynomial in Equation 
(jlj) is not identically 0. Assuming that both coefficients are zero, we get 

Ab 2k ~ s + (ba) 2 ~ k ~ s B = 0, 
Bb+(ba) 2 ~"A = 0. 
We combine the equations above to obtain 
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Bb+(ba) 2 ~*b 2 -*~ a - 2 *~ a a 2 - k -"B = 0. 
So we have }^-2- k +2 k - a -2- k - a _ a 2- -"+2- _ Substituting a with t 2fc_1 , 
rearranging and factoring the powers gives 

Here we observe that only the left hand side of the above equation is a 
seventh power, thus obtaining the desired contradiction. We conclude that 
the size of the kernel K is less than 4. This finishes the argument. 

It finally remains to show that the coefficients A, B are non-zero. Setting 
A to gives rise to the equation 

2 fc — 2 s j 2fc~l~ s 



jl-2- k+a _|_ n )a \2 k +2 k + B \ / ^ a ^2 k - a +2 k -' 2a _|_ ^2- fc - s -2 fc - J ' 



^2- a +2 k - 2a _|_ ^2- fe +2-'=- s Q ,2-'=- 2s +2- fc - s J I [ba) 2S+l + fr 2 ~ fc +2 fe+s 

Substituting a with t 2 ** -1 and rearranging gives the equation 

^ 2 fc-2s+i( 2 fc„ 1 ) _ ^ 2 ft - 2s -2- fc - 2s (2 3a -l) j^2 2k+2a -lrpl-2 2k+2a 



where 



and 



_ j ) 2- a +2 k - 2a _|_ y2~ k +2- k - a a 2- k - 2a +2- k - a 



m //i x ofc — siofc — 2s , 9— fc— s 9 — k — 2s, 

T = ((hot) +2 +b 2 2 ). 



Reducing the powers of 2 modulo 3 shows that the right hand side of the 
equation above is a seventh power, while the left hand side is not. We 
conclude that A ^ 0. 

Suppose B = 0, then the only solution of Equation <^ is u = 0. We can 
therefore assume that both A and B are non-zero. 

This completes the proof of the theorem for the case when f = f\. When 
/ = f2 a similar proof applies. We interchange k and —k in all equations 
and use the fact that in this case 3 divides k — s. 
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4 Family (2), Binomials over GF(2 Ak ) 

We now compute the Fourier spectrum for family (2). 

Theorem 4 Let L = GF{2 n ) and f(x) = / +1 + ai 2 " +rHs , where n = 4k, 
(k,2) = (s,2k) — 1, k > 3, i = sk mod 4, m = 4 — i, a = t 2k ^ 1 and t is 
primitive. Then f has Fourier spectrum {0, ±2"/ 2 , ±2^}. 

Proof: Since s, k are chosen to be odd, sk = ±1 mod 4. Therefore there 
are two possibilities for our function f(x): 

f l (x)=x 2S+1 + ax 2 ' k+2k+s sk = -l mod 4 

and 

f 2 (x) = x T+1 + ax 2k+2 ~ k+3 sk = 1 mod 4. 

Let us consider the first case, when f — f l . As discussed in the proof 
of the previous theorem, since / is APN, it suffices to demonstrate that the 
equation 

L b (u) = bu 2 " + {buf- s + {baf mk u 22k+s + {baf lk - s u 22k ~ 8 = 0. 

has at most four solutions for all non-zero b in L. 

All the solutions of L h (u) = are also solutions of the equation 

b- 22k L b (uf k + (ba)- 2k L b (u) = 0. 

This gives 



(6 2fc+22fc - V + fc 2 "* 2 "*" V~*~> 2 fc ~ s = 0. (5) 
We also compute b~ 2 3+2 L b (u) 22 + (6a) -2 * ' L b {u) = to obtain 
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(br +z a 2 + 6^ +z or )u z = 0. (6) 
Writing Equation (JSJ) as 

c« 2S + ck 2 "* + eM 22fc+s = (7) 
we see that Equation (jHJ) becomes 

cT w 2 + c 2 u 2 + eu 2 = 0. (8) 

We combine Equations (171) and (jSJ) to cancel the third term from each 
expression. This yields the following equation 

r*( \ I 2 s 2~ s i 2~ s 2 2k+s \ , 2 s j2~ s 2~ 2s , 2~ s j2 2s 2 2s n fn\ 

G[u) := (e c + e c )u + e a u +e a u =0. (9) 
Now for some non-zero u in the kernel of G(u), we consider the equation 
G„(u) := uG{u) + + (u + v)G(u + v) = 0. (10) 

Substituting gives 

2 s j2 - V 2 _2s i 2 _2s \ i 2 _s j2 2s / 2 2s , 2 2s \ n /1 1 \ 

e a (u v + v u) + e a (u v + v u) — 0. (11) 

Note that ker(G(u)) is contained in ker(G v (u)). 

We now show that Lb(u) = has at most four solutions. This will be 
done in five steps, which complete the proof. 

(i) We show that d ^ implies that gP _1 is not a cube. 

Recall that d = h 2 ^^ + 6 2 fc -+2-*- t 2»*-+2--2»-'- 2 -*- i This im _ 
plies that 

^2 s -l _ ^-2- s - fc (2 2fc +l)(2 s -l)^2 s -l 

where A = 6 2»*-+2- t 2*- + 2-*- + 6 2*-+2-*- t 2»*- + 2-_ As A = A 2 \ we 
have A G GF(2 k ). Furthermore, as is odd, all elements of GF(2 k ) 
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are cubes. We conclude that A 2S ~ l is a cube. Now if gP -1 is a cube, 
then so is £( 22, "+i)(2 s -i)_ t ms j s impossible as (2 2k + 1)(2 S — 1) is not 
divisible by 3 and t is primitive. 

(ii) We show that if c, d, e ^ and gP _1 is not a cube then ffTTl) has at 
most four solutions. 

Assume that the coefficients e, c, d are non-zero and that d 2S ~ l is not a 
cube. Now -u 22s f + v 22s u = if and only if w -1 G GF(A). Therefore we 
have exactly four solutions in u, namely u = vw for each w G GF(4). 
If, on the other hand, u 2,2 " v + v 22s u ^ 0, we can rearrange (|lip to obtain 



j2 s -l / 2~ 2s , 2 _2s \2 2s -l 2~ s -2 3 j2 2s -1 

a = [u v + v u) e a 

Using the fact that 3 divides 2 r — 1 if and only if r is even, we see that 
the right hand side of this expression is a cube while the left hand side 
is not. Thus, the kernel of has at most four elements. 

(iii) We demonstrate that e ^ 0. 

For the sake of contradiction suppose that e = 0. Then we have 

^2^^ — s -j-2^ — 2*^ 2 — ^ — s ^2^^ — s 2 — s 

and hence 



^-1^2 2fc-s +2 ,s -2 2 ' = -2 -fe ~ s £2 2fc ~ s -2~ s _ ^ 

Further rearrangement gives 

^-l^(l-2 fc )(2 2fc - s +2 fc ) = £2~ s (l-2 2fc ) ^) 

As 4 divides k + s, 2 k+s = 1 mod 5. Also 2 2k + 1 = mod 5 for any 
odd k. Therefore 5 divides 2 k+s + 2 2k and hence 5 divides 2 k + 2 2k ~ s . 
The left hand side of (I12p is a fifth power while the right hand side is 
not because t is primitive and 2 _s (l — 2 2k ) is not a multiple of 5. We 
conclude that e ^ 0. 
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(iv) We next rule out the case c = 0. 



Suppose c = 0. Then we have 




• — k — s 




1 



from which we derive 

^-l^(2 fc -l)(2- fc -2 2fe - s ) _ ^2~ s (2 2fe -l) 

By similar observations as before we can demonstrate that only the left 
hand side of the expression above is a fifth power. This gives us the 
desired contradiction and we conclude that c ^ 0. 

(v) We show that if d = then L\,{u) = has at most 4 solutions. 
Suppose that d = 0. Then Equation (JTj) becomes 



Let H(u) := c 2 "u + e 2 "u 2 , so that solutions to ( |T3i) comprise the 
kernel of H(u). For some v ^ in the kernel of H(u), consider the 
equation 

H v (u) := uH{u) + vH(v) + (u + v)H{u + v) = 0. 

This yields H v (u) = e 2 s (u 22k v + v 22k u) = 0, from which we obtain 
u 2 2k _ v 2 2k 1 U Applying this relation to L&(it) = gives us the equa- 
tion 



c u + eu 



22k — s 



0. 



(13) 



L b (u) = {b+{ba) 2 v 



)u 28 + (b 2 ~ s + (ba) 



n — k — s n2k — s s 

1 v 



)u 



0. 



If both coefficients in the above expression are non-zero, then, by Corol- 
lary [21 it has at most four solutions. If exactly one of the coefficients is 
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0, then u = is the unique solution. If both coefficients vanish, then 
we have 

IF* + (baf-'v 22 "- 1 = 0, 

and 

b+ibaf-'v 22 "' 1 = 0, 

From which we derive 

n'2k i -o — k ryk — s ofc — s ,i o — k o — k 

v l 1 = b 2 1 a — b x a 

which implies that e = 0, a previously established contradiction. 

This completes the proof of the theorem for the case when f = f\. When 
/ = /ja near identical proof applies. We simply interchange k and —A; in all 
equations and use the fact that in this case 5 divides 2 k ~ s — 1 to achieve the 
required contradictions concerning fifth powers. □ 

5 Families (3) and (4) 

For proofs of the following theorems, which compute the Fourier spectra of 
families (3) and (4), see [2] and [3] respectively. We state the results here for 
completeness. 

Theorem 5 Let n = 2k and let 

k-l 

t( \ 2 S + 1 i 2 k 2 k+s +2 k i n 2 fc + l , 2 fc+4 +2 i 

j(x)=ax + a x + px + y,li x > 

2=1 

where a and (3 are primitive elements of L, and ^ e GF(2 k ) for each i and 
(k, s) = 1. Then the Fourier spectrum of f(x) is {0, ±2f , ±2^}. 

Theorem 6 Let 

f( x ) = x 3 + Tr(x 9 ) 

on L. Then the Fourier spectrum of f{x) is {0,^=2^} when n is odd and 
{0, ±2t, ±2 Ii 2 2 } when n is even. 
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6 Closing remarks and open problems 

For each of the above quadratic APN functions considered, the Fourier spec- 
trum turned out to be the same as the Gold functions. The example of Dillon 
on GF(2 6 ) cited in the introduction of this paper is the only known example 
of a quadratic APN function that does not have this spectrum. This means 
that the dual code of this function (as defined in Section 2) has the same 
minimum distance as the double error-correcting BCH code (the dual code 
corresponding to the function x 3 ), but has a different weight distribution. 

Open problem 1: Find other examples of quadratic APN functions for 
even n that do not have the same Fourier spectrum as the Gold function x 3 . 

In pQ the following trinomial function (family (5) in the introduction) 
over GF(2 3k ) was shown to be APN: 

cl \ 2~ k +2 k+a i 2 k 2 a +l i 2 k+3 +2 s 

j(x)=ux ^ + U X + V X , 
where u is primitive, v G GF{2 k ), (s, 3k) = 1, (3, k) = 1 and 3 divides k + s. 

Open problem 2: Determine the Fourier spectrum of the above APN 
function. 
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